It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

It attempted to use the FTP server to distribute SQL injection tools.

This IP belongs to Facebook.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

It attempted to perform a man-in-the-middle attack on the IMAP server.

It attempted to perform a Chargen amplification attack on the SSH server.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

Excessive traffic from a single IP address.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

It showed unusual activity in the server's error logs.

It attempted to use the FTP server to distribute network scanning tools.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

The IP attempted to perform a SNMP amplification attack on the SSH server.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

This IP was caught circulating email worms, camouflaged as legitimate mails.

It was flagged that this IP had been used in conducting method tampering on our servers.